MapSVG Plugin Flaw CVSS 9.9 Allows Web Shell Upload Through Version 8.16.1

The National Vulnerability Database recorded CVE-2026-111406 as a critical security flaw in MapSVG software developed by PT Norther Lights Production. This vulnerability allows attackers to upload unauthorized files to web servers hosting the affected application. The issue stems from inadequate validation of uploaded file types within the software.

According to the NVD record, the flaw carries a CVSS score of 9.9, marking it as critical severity. The underlying weakness is identified as CWE-434, which denotes unrestricted upload of files with dangerous types. This classification indicates that the application fails to properly restrict the kinds of files users can submit. Consequently, an attacker can bypass standard security controls to place executable code on the server.

Context and Background

The specific impact described in the advisory is the ability to upload a web shell to the web server. A web shell is a script that allows remote execution of commands, effectively giving an attacker control over the compromised system. This type of access can lead to further exploitation, data theft, or the use of the server for other malicious activities. The NVD description explicitly links the unrestricted upload capability to this severe outcome.

The vulnerability exists in the MapSVG product, which provides interactive vector maps. The product is developed by PT Norther Lights Production. The advisory notes that the flaw affects versions of MapSVG from the earliest available version through 8.16.1. There is no indication in the source material that a patched version has been released to address this specific issue.

Who Is Affected

Any organization or individual using the MapSVG software on their website is potentially at risk if they have not updated beyond version 8.16.1. The NVD record states that the issue affects MapSVG from n/a through 8.16.1. This means that all current installations running this version or any earlier release are vulnerable to the described attack vector. Users of this software should verify their current version immediately to determine their exposure.

The scope of the vulnerability is limited to the MapSVG product itself. It does not appear to affect other products from PT Norther Lights Production based on the provided information. However, because web shells provide significant control over a server, the compromise of any site running this software could have broader implications for the hosting environment and network security.

What should you do?

Security teams should audit their installations to identify any sites using the MapSVG software. If the software is present, administrators must check the version number against the affected range. Since no fix is confirmed in the source material, immediate action should focus on containment and monitoring. Disabling the software or removing it from production environments may be necessary if an update is not available.